cdk-local 0.161.2 → 0.162.1

package/dist/{local-studio-CVy7mUW9.js → local-studio-D8eIrFzx.js}

@@ -1,7 +1,7 @@
 import { a as displayIdent, c as getEmbedConfig, i as STACK_REF_MAX_CODE_POINTS, o as displayStackName, s as displayToolOutput, t as getLogger, u as setEmbedConfig } from "./logger-Co5XVwco.js";
 import { C as effectiveLoopbackPorts, G as isWildcardHostname, H as proxyAwareFetch, J as hostFromAuthority, K as formatAuthority, P as resolveHostDefaultCredentials, W as isLoopbackHostname, b as awsEmulatorEnvName, d as workloadStsClientConfig, l as warnWorkloadCredentialsStripped, n as accountLookupStsClientConfig, q as formatHostForAuthority, r as applyWorkloadEnvCredentials, u as workloadClientConfig, v as activateWorkloadAwsWiring, w as getActiveWorkloadAwsWiring, y as applyWorkloadAwsWiringToEnv, z as buildProxyClientConfig } from "./workload-identity-ITM3p2Ed.js";
 import { c as clampErrorName, d as flattenToOneLine, f as isAwsServiceException, l as describeAwsFailureForWarn, m as stringifyThrown, o as renderAssemblyPathEscape, p as sanitizeServiceExceptionMessage, r as displayUntrustedValue, s as resolveAssemblyPath, t as absoluteAssemblyPathEscape, u as describeCredentialLoadFailure } from "./assembly-path-R96uhMm1.js";
-import { A as parseEcrRegistryHost, B as RouteDiscoveryError, C as warnIfEmulatedPlatform, D as buildDockerImage, E as pullEcrImage, F as tryResolveImageFnJoin, G as applyRoleArnIfSet, H as withErrorHandling, I as CdkLocalError, J as isIamRoleArn, K as assumeRoleCredentials, L as InteractiveTtyRequiredError, M as derivePseudoParametersFromRegion, N as formatStateRemedy, O as resolveAssetSourcePath, P as substituteImagePlaceholders, R as LocalInvokeBuildError, S as buildContainerImage, T as parseEcrUri, U as defineOwnKey, V as TargetSelectionCancelledError, W as AssumeRoleFailure, X as buildStsClientConfig, Y as refusedRoleArnMessage, Z as resolveProfileCredentials, a as describeRefusedSensitiveEnvKeys, c as execEnvForSecrets, d as pullImage, f as removeContainer, i as attachLoopbackForwarder, j as derivePartitionAndUrlSuffix, k as describeExitWithoutArgv, l as pickFreePort, m as streamLogs, n as SENSITIVE_ENV_KEYS, p as runDetached, q as describeRejectedRoleArn, r as appendEnvFlags, s as ensureDockerAvailable, t as DockerRunnerError, u as prepareLoopbackForwarder, w as isImageInLocalCache, x as architectureToPlatform, z as LocalStartServiceError } from "./docker-runner-D9E9mLH-.js";
+import { $ as buildStsClientConfig, A as buildDockerImage, B as InteractiveTtyRequiredError, D as isImageInLocalCache, E as warnIfEmulatedPlatform, F as derivePseudoParametersFromRegion, G as withErrorHandling, H as LocalStartServiceError, I as formatStateRemedy, J as applyRoleArnIfSet, K as defineOwnKey, L as substituteImagePlaceholders, M as describeExitWithoutArgv, N as parseEcrRegistryHost, O as parseEcrUri, P as derivePartitionAndUrlSuffix, Q as refusedRoleArnMessage, R as tryResolveImageFnJoin, T as buildContainerImage, U as RouteDiscoveryError, V as LocalInvokeBuildError, W as TargetSelectionCancelledError, X as describeRejectedRoleArn, Y as assumeRoleCredentials, Z as isIamRoleArn, a as describeRefusedSensitiveEnvKeys, c as execEnvForSecrets, d as rememberForwardedPorts, et as resolveProfileCredentials, f as removeContainer, h as streamLogs, i as attachLoopbackForwarder, j as resolveAssetSourcePath, k as pullEcrImage, l as pickFreePort, m as startNamespaceOwnerForwarder, n as SENSITIVE_ENV_KEYS, p as runDetached, q as AssumeRoleFailure, r as appendEnvFlags, s as ensureDockerAvailable, t as DockerRunnerError, u as pullImage, w as architectureToPlatform, z as CdkLocalError } from "./docker-runner-CLlVjU7l.js";
 import { a as isDockerClientEnvKey, c as runDockerStreaming, i as getDockerCmd, n as finchSecretArgvRefusal, o as isMalformedEnvKey, u as warnFinchArgvExposure } from "./docker-cmd-Cjg3jGYF.js";
 import { chmodSync, cpSync, createWriteStream, existsSync, lstatSync, mkdirSync, mkdtempSync, promises, readFileSync, readdirSync, readlinkSync, realpathSync, rmSync, statSync, symlinkSync, unlinkSync, writeFileSync } from "node:fs";
 import { Command, InvalidArgumentError, Option } from "commander";
@@ -14929,7 +14929,8 @@ function createEcsRunState() {
 		dockerVolumeNames: [],
 		startedContainers: [],
 		logStoppers: [],
-		publishedEndpoints: []
+		publishedEndpoints: [],
+		forwarders: []
 	};
 }
 async function cleanupEcsRun(state, options) {
@@ -14940,6 +14941,8 @@ async function cleanupEcsRun(state, options) {
 		logger.debug(`log stream stop failed: ${err instanceof Error ? err.message : String(err)}`);
 	}
 	state.logStoppers = [];
+	await removeForwarders((state.forwarders ?? []).filter((f) => !f.joined));
+	state.forwarders = (state.forwarders ?? []).filter((f) => f.joined);
 	if (!options.keepRunning) {
 		for (const c of state.startedContainers) {
 			try {
@@ -14954,6 +14957,8 @@ async function cleanupEcsRun(state, options) {
 			}
 		}
 		state.startedContainers = [];
+		await removeForwarders(state.forwarders);
+		state.forwarders = [];
 	}
 	if (state.network && !state.network.ownedByCaller) await destroyTaskNetwork(state.network);
 	state.network = void 0;
@@ -14969,6 +14974,9 @@ async function cleanupEcsRun(state, options) {
 	}
 	state.dockerVolumeNames = [];
 }
+async function removeForwarders(forwarders) {
+	for (const f of forwarders) await removeContainer(f.id || f.name);
+}
 function mergeHostGatewayAddHostFlags(addHostFlags, hostGatewayExtraHosts) {
 	return [...addHostFlags ?? [], ...(hostGatewayExtraHosts ?? []).flatMap((h) => ["--add-host", `${h.host}:${h.ip}`])];
 }
@@ -15106,7 +15114,8 @@ async function runEcsTask(task, options, state) {
 		dockerCmds.set(container.name, {
 			args: built.args,
 			sensitiveEnv: built.sensitiveEnv,
-			loopbackPorts: built.loopbackPorts
+			loopbackPorts: built.loopbackPorts,
+			...built.forwarder ? { forwarder: built.forwarder } : {}
 		});
 		if (built.collisions.length > 0) logger.warn(describeRefusedSensitiveEnvKeys(`Container ${displayUntrustedValue(container.name)}`, built.collisions));
 		for (const ep of built.publishedEndpoints) state.publishedEndpoints.push(ep);
@@ -15115,9 +15124,31 @@ async function runEcsTask(task, options, state) {
 	for (const containerName of startOrder) {
 		const container = task.containers.find((c) => c.name === containerName);
 		await awaitDependencies(container, startedByName);
-		const { args, sensitiveEnv, loopbackPorts } = dockerCmds.get(container.name);
-		const forwarderWiring = getActiveWorkloadAwsWiring();
-		if (loopbackPorts.length > 0 && forwarderWiring) await prepareLoopbackForwarder(forwarderWiring);
+		const cmd = dockerCmds.get(container.name);
+		const { sensitiveEnv, loopbackPorts } = cmd;
+		let args = cmd.args;
+		const wiring = getActiveWorkloadAwsWiring();
+		let joined;
+		if (cmd.forwarder && wiring && loopbackPorts.length > 0) {
+			const fwd = cmd.forwarder;
+			const fwdId = await startNamespaceOwnerForwarder({
+				name: fwd.name,
+				namespace: fwd.namespace,
+				ports: loopbackPorts,
+				wiring,
+				workloadLabel: `container ${displayIdent(container.name)}`
+			});
+			if (fwdId !== void 0) {
+				joined = {
+					containerName: container.name,
+					name: fwd.name,
+					id: fwdId,
+					joined: false
+				};
+				state.forwarders.push(joined);
+				args = fwd.args;
+			}
+		}
 		logger.info(`Starting container ${displayIdent(container.name)} (image=${displayIdent(imagePlan.get(container.name))})`);
 		let id;
 		warnFinchArgvExposure(Object.keys(sensitiveEnv));
@@ -15135,12 +15166,12 @@ async function runEcsTask(task, options, state) {
 			name: container.name,
 			id
 		});
+		if (joined) joined.joined = true;
+		else if (wiring) rememberForwardedPorts(id, wiring, loopbackPorts);
 		startedByName.set(container.name, {
 			id,
 			container
 		});
-		const wiring = getActiveWorkloadAwsWiring();
-		if (wiring) await attachLoopbackForwarder(id, wiring, loopbackPorts);
 		if (!options.detach) state.logStoppers.push(attachContainerLogStreamer(`[${displayIdent(container.name)}] `, id));
 	}
 	if (options.detach) return {
@@ -15419,23 +15450,42 @@ async function resolvePrivilegedHostPortRemaps(opts) {
 function buildDockerRunArgs(opts) {
 	const { task, container, image, network, volumeByName, secrets, containerHost, roleArn } = opts;
 	const args = ["run", "-d"];
+	const joinArgs = ["run", "-d"];
+	const both = (...xs) => {
+		args.push(...xs);
+		joinArgs.push(...xs);
+	};
+	const ownerAliases = [];
+	const ownerPublish = [];
+	const ownerAddHosts = [];
+	const ownerLinks = [];
 	const publishedEndpoints = [];
-	args.push("--name", `${getEmbedConfig().resourceNamePrefix}-${task.family}-${container.name}-${randHex(3)}`);
+	const dockerName = `${getEmbedConfig().resourceNamePrefix}-${task.family}-${container.name}-${randHex(3)}`;
+	const forwarderName = `${dockerName}-awsfwd`;
+	both("--name", dockerName);
 	args.push("--network", network);
-	if (!opts.omitContainerNameAlias) args.push("--network-alias", container.name);
+	joinArgs.push("--network", `container:${forwarderName}`);
+	if (!opts.omitContainerNameAlias) {
+		args.push("--network-alias", container.name);
+		ownerAliases.push(container.name);
+	}
 	if (opts.networkAliases && opts.networkAliases.length > 0) {
 		const seen = /* @__PURE__ */ new Set([container.name]);
 		for (const a of opts.networkAliases) if (!seen.has(a)) {
 			args.push("--network-alias", a);
+			ownerAliases.push(a);
 			seen.add(a);
 		}
 	}
-	if (opts.addHostFlags && opts.addHostFlags.length > 0) for (const f of opts.addHostFlags) args.push(f);
+	if (opts.addHostFlags && opts.addHostFlags.length > 0) {
+		for (const f of opts.addHostFlags) args.push(f);
+		for (let i = 0; i + 1 < opts.addHostFlags.length; i++) if (opts.addHostFlags[i] === "--add-host") ownerAddHosts.push(opts.addHostFlags[++i]);
+	}
 	let resolvedPlatform;
 	if (opts.platformOverride) resolvedPlatform = opts.platformOverride;
 	else if (task.runtimePlatform) resolvedPlatform = task.runtimePlatform.cpuArchitecture === "ARM64" ? "linux/arm64" : "linux/amd64";
 	if (resolvedPlatform) {
-		args.push("--platform", resolvedPlatform);
+		both("--platform", resolvedPlatform);
 		warnIfEmulatedPlatform(resolvedPlatform, { label: `${task.family}/${container.name}` });
 	}
 	const ephemeralPorts = new Set(opts.ephemeralPublishContainerPorts ?? []);
@@ -15446,7 +15496,9 @@ function buildDockerRunArgs(opts) {
 		const overridden = hostPort !== declaredHostPort;
 		const overrideNote = opts.autoRemappedContainerPorts?.has(pm.containerPort) ?? false ? " (privileged-port auto-remap)" : overridden ? " (--host-port override)" : "";
 		getLogger().child("ecs").info(`Container ${displayIdent(container.name)} container port ${pm.containerPort} published on ${formatAuthority(containerHost, hostPort)}${overrideNote}. Reach it at ${formatAuthority(containerHost, hostPort)}.`);
-		args.push("-p", `${containerHost}:${hostPort}:${pm.containerPort}/${pm.protocol}`);
+		const publish = `${containerHost}:${hostPort}:${pm.containerPort}/${pm.protocol}`;
+		args.push("-p", publish);
+		ownerPublish.push(publish);
 		publishedEndpoints.push({
 			containerName: container.name,
 			containerPort: pm.containerPort,
@@ -15461,24 +15513,26 @@ function buildDockerRunArgs(opts) {
 		for (const pm of container.portMappings) {
 			if (!ephemeralPorts.has(pm.containerPort) || alreadyEphemeral.has(pm.containerPort)) continue;
 			alreadyEphemeral.add(pm.containerPort);
-			args.push("-p", `${containerHost}::${pm.containerPort}/${pm.protocol}`);
+			const publish = `${containerHost}::${pm.containerPort}/${pm.protocol}`;
+			args.push("-p", publish);
+			ownerPublish.push(publish);
 		}
 	}
 	const wiring = getActiveWorkloadAwsWiring();
 	const profileCredentialsFile = wiring?.mode === "emulator" ? void 0 : opts.profileCredentialsFile;
-	if (profileCredentialsFile) args.push("-v", `${profileCredentialsFile.hostPath}:${profileCredentialsFile.containerPath}:ro`);
-	for (const m of wiring?.mounts ?? []) if (!container.mountPoints.some((mp) => mp.containerPath === m.containerPath)) args.push("-v", `${m.hostPath}:${m.containerPath}:ro`);
+	if (profileCredentialsFile) both("-v", `${profileCredentialsFile.hostPath}:${profileCredentialsFile.containerPath}:ro`);
+	for (const m of wiring?.mounts ?? []) if (!container.mountPoints.some((mp) => mp.containerPath === m.containerPath)) both("-v", `${m.hostPath}:${m.containerPath}:ro`);
 	for (const mp of container.mountPoints) {
 		const v = volumeByName.get(mp.sourceVolume);
 		if (!v) continue;
 		if (v.kind === "host") if (v.hostPath) {
 			const ro = mp.readOnly ? ":ro" : "";
-			args.push("-v", `${v.hostPath}:${mp.containerPath}${ro}`);
-		} else args.push("-v", mp.containerPath);
+			both("-v", `${v.hostPath}:${mp.containerPath}${ro}`);
+		} else both("-v", mp.containerPath);
 		else {
 			const name = v.dockerVolumeName ?? v.name;
 			const ro = mp.readOnly ? ":ro" : "";
-			args.push("-v", `${name}:${mp.containerPath}${ro}`);
+			both("-v", `${name}:${mp.containerPath}${ro}`);
 		}
 	}
 	let finalEnv = {};
@@ -15510,32 +15564,49 @@ function buildDockerRunArgs(opts) {
 	for (const s of container.secrets) sensitiveEnvKeys.add(s.name);
 	for (const n of container.droppedSecretNames ?? []) sensitiveEnvKeys.add(n);
 	for (const k of container.sensitiveEnvKeys) sensitiveEnvKeys.add(k);
-	const { passthrough: sensitiveEnv, collisions } = appendEnvFlags(args, finalEnv, sensitiveEnvKeys);
-	if (container.user) args.push("--user", container.user);
-	if (container.privileged) args.push("--privileged");
-	if (container.readonlyRootFilesystem) args.push("--read-only");
-	if (container.workingDirectory) args.push("--workdir", container.workingDirectory);
-	for (const u of container.ulimits) args.push("--ulimit", `${u.name}=${u.softLimit}:${u.hardLimit}`);
-	for (const link of container.links) args.push("--link", link);
+	const envFlags = [];
+	const { passthrough: sensitiveEnv, collisions } = appendEnvFlags(envFlags, finalEnv, sensitiveEnvKeys);
+	both(...envFlags);
+	if (container.user) both("--user", container.user);
+	if (container.privileged) both("--privileged");
+	if (container.readonlyRootFilesystem) both("--read-only");
+	if (container.workingDirectory) both("--workdir", container.workingDirectory);
+	for (const u of container.ulimits) both("--ulimit", `${u.name}=${u.softLimit}:${u.hardLimit}`);
+	for (const link of container.links) {
+		args.push("--link", link);
+		ownerLinks.push(link);
+	}
 	if (container.healthCheck) {
-		args.push("--health-cmd", shellJoin(container.healthCheck.command));
-		if (container.healthCheck.interval !== void 0) args.push("--health-interval", `${container.healthCheck.interval}s`);
-		if (container.healthCheck.timeout !== void 0) args.push("--health-timeout", `${container.healthCheck.timeout}s`);
-		if (container.healthCheck.retries !== void 0) args.push("--health-retries", String(container.healthCheck.retries));
-		if (container.healthCheck.startPeriod !== void 0) args.push("--health-start-period", `${container.healthCheck.startPeriod}s`);
+		both("--health-cmd", shellJoin(container.healthCheck.command));
+		if (container.healthCheck.interval !== void 0) both("--health-interval", `${container.healthCheck.interval}s`);
+		if (container.healthCheck.timeout !== void 0) both("--health-timeout", `${container.healthCheck.timeout}s`);
+		if (container.healthCheck.retries !== void 0) both("--health-retries", String(container.healthCheck.retries));
+		if (container.healthCheck.startPeriod !== void 0) both("--health-start-period", `${container.healthCheck.startPeriod}s`);
 	}
 	let entryPointTail = [];
 	if (container.entryPoint && container.entryPoint.length > 0) {
-		args.push("--entrypoint", container.entryPoint[0]);
+		both("--entrypoint", container.entryPoint[0]);
 		entryPointTail = container.entryPoint.slice(1);
 	}
-	args.push(image, ...entryPointTail, ...container.command ?? []);
+	both(image, ...entryPointTail, ...container.command ?? []);
+	const loopbackPorts = wiring ? effectiveLoopbackPorts(finalEnv, wiring) : [];
 	return {
 		args,
 		sensitiveEnv,
 		collisions,
 		publishedEndpoints,
-		loopbackPorts: wiring ? effectiveLoopbackPorts(finalEnv, wiring) : []
+		loopbackPorts,
+		...loopbackPorts.length > 0 && { forwarder: {
+			name: forwarderName,
+			namespace: {
+				network,
+				networkAliases: ownerAliases,
+				publish: ownerPublish,
+				addHosts: ownerAddHosts,
+				links: ownerLinks
+			},
+			args: joinArgs
+		} }
 	};
 }
 function shellJoin(parts) {
@@ -15978,6 +16049,12 @@ function containerPublishesHostPorts(container, opts) {
 	if (!opts.skipHostPortPublish) return true;
 	return container.portMappings.some((pm) => opts.ephemeralPublishContainerPorts.includes(pm.containerPort));
 }
+function networkEndpointId(state, containerName, containerId) {
+	return (state.forwarders ?? []).find((f) => f.containerName === containerName && f.joined)?.id ?? containerId;
+}
+function joinsForwarder(state, containerName) {
+	return (state.forwarders ?? []).some((f) => f.containerName === containerName && f.joined);
+}
 async function publishGatedReplica(service, options, instance, deadline, isShuttingDown, label = `Shadow replica r${instance.index} (gen ${instance.generation})`) {
 	const network = instance.state.network;
 	const withheld = instance.withheldAliasContainers ?? [];
@@ -15996,12 +16073,13 @@ async function publishGatedReplica(service, options, instance, deadline, isShutt
 				}
 			}
 			if (isShuttingDown()) return;
-			const ip = await getContainerNetworkIp(started.id, network.networkName);
+			const endpoint = networkEndpointId(instance.state, name, started.id);
+			const ip = await getContainerNetworkIp(endpoint, network.networkName);
 			if (!ip) throw new EcsServiceRunnerError(`${label}: no docker IP for ${displayIdent(name)} on ${network.networkName}; cannot attach its Service Connect aliases.`);
 			const aliases = [name];
 			for (const a of fullAliases.get(name) ?? []) if (!aliases.includes(a)) aliases.push(a);
-			await dockerNetworkDisconnectImpl(network.networkName, started.id);
-			await dockerNetworkConnectImpl(network.networkName, started.id, {
+			await dockerNetworkDisconnectImpl(network.networkName, endpoint);
+			await dockerNetworkConnectImpl(network.networkName, endpoint, {
 				ip,
 				aliases
 			});
@@ -16034,7 +16112,7 @@ async function publishReplicaToCloudMap(service, instance, discovery, ownerKeyPr
 	if (!started) return;
 	let ip;
 	try {
-		ip = await getContainerNetworkIp(started.id, networkName);
+		ip = await getContainerNetworkIp(networkEndpointId(instance.state, started.name, started.id), networkName);
 	} catch (err) {
 		logger.warn(`Replica ${instance.index}: docker inspect failed before Cloud Map publish: ${err instanceof Error ? err.message : String(err)}`);
 		return;
@@ -16101,7 +16179,7 @@ async function publishReplicaToFrontDoor(service, instance, frontDoor, container
 		}
 		let hostPort;
 		try {
-			hostPort = await getPublishedHostPort(started.id, target.targetContainerPort);
+			hostPort = await getPublishedHostPort(networkEndpointId(instance.state, started.name, started.id), target.targetContainerPort);
 		} catch (err) {
 			logger.warn(`Replica ${instance.index}: docker inspect failed before front-door publish: ${err instanceof Error ? err.message : String(err)}`);
 			continue;
@@ -16244,6 +16322,8 @@ async function softReloadReplica(args) {
 		targets.push({
 			name: container.name,
 			id,
+			endpoint: networkEndpointId(instance.state, container.name, id),
+			joined: joinsForwarder(instance.state, container.name),
 			aliases,
 			...port !== void 0 ? { port } : {}
 		});
@@ -16288,12 +16368,12 @@ async function softReloadReplica(args) {
 			const plan = attachPlans.get(target.id);
 			if (plan && (plan.publishesHostPorts || !plan.attached)) {
 				if (plan.attached) {
-					await dockerNetworkDisconnectImpl(plan.networkName, target.id);
+					await dockerNetworkDisconnectImpl(plan.networkName, plan.endpointId);
 					plan.attached = false;
 				}
-				await attachToSharedNetwork(target.id, plan, plan.publishesHostPorts);
+				await attachToSharedNetwork(plan, plan.publishesHostPorts);
 			}
-			await dockerStartImpl(target.id);
+			await dockerStartImpl(target.id, { joinedForwarder: target.joined });
 		} catch (err) {
 			throw new EcsServiceRunnerError(`softReloadReplica: docker stop / start of ${displayIdent(target.name)} (${target.id}) failed: ${err instanceof Error ? err.message : String(err)}. This replica is unregistered from Cloud Map + the front-door pool until the next save triggers another reload.`);
 		}
@@ -16308,9 +16388,9 @@ async function softReloadReplica(args) {
 			if (!plan || plan.aliasesAttached) continue;
 			if (target.port !== void 0) await waitForContainerListening(target.id, target.port, aliasDeadline);
 			try {
-				await dockerNetworkDisconnectImpl(plan.networkName, target.id);
+				await dockerNetworkDisconnectImpl(plan.networkName, plan.endpointId);
 				plan.attached = false;
-				await attachToSharedNetwork(target.id, plan, true);
+				await attachToSharedNetwork(plan, true);
 			} catch (err) {
 				throw new EcsServiceRunnerError(`softReloadReplica: restoring the network aliases of ${displayIdent(target.name)} (${target.id}) failed: ${err instanceof Error ? err.message : String(err)}. This replica is unregistered from Cloud Map + the front-door pool until the next save triggers another reload.`);
 			}
@@ -16321,7 +16401,8 @@ async function softReloadReplica(args) {
 		instance.lastDeployedAssetHash = pickEssentialAssetHash(newService);
 		logger.info(`Soft-reloaded replica r${instance.index} (gen ${instance.generation}): ` + (ready ? SOFT_RELOAD_COMPLETION_LOG_SUFFIX : SOFT_RELOAD_PROBE_TIMEOUT_LOG_SUFFIX));
 	} catch (err) {
-		for (const [id, plan] of attachPlans) {
+		for (const plan of attachPlans.values()) {
+			const id = plan.endpointId;
 			if (plan.aliasesAttached) continue;
 			try {
 				if (plan.attached) {
@@ -16329,7 +16410,7 @@ async function softReloadReplica(args) {
 					plan.attached = false;
 				}
 				try {
-					await attachToSharedNetwork(id, plan, true);
+					await attachToSharedNetwork(plan, true);
 				} catch {
 					await dockerNetworkConnectImpl(plan.networkName, id, { aliases: plan.aliases });
 					plan.attached = true;
@@ -16374,15 +16455,16 @@ const defaultDockerStopImpl = async (containerId) => {
 	const { getDockerCmd } = await import("./docker-cmd-Cjg3jGYF.js").then((n) => n.t);
 	await promisify(execFile)(getDockerCmd(), ["stop", containerId]);
 };
-const defaultDockerStartImpl = async (containerId) => {
+const defaultDockerStartImpl = async (containerId, opts = {}) => {
 	const { execFile } = await import("node:child_process");
 	const { promisify } = await import("node:util");
 	const { getDockerCmd } = await import("./docker-cmd-Cjg3jGYF.js").then((n) => n.t);
 	await promisify(execFile)(getDockerCmd(), ["start", containerId]);
+	if (opts.joinedForwarder) return;
 	const { getActiveWorkloadAwsWiring } = await import("./workload-identity-ITM3p2Ed.js").then((n) => n.L);
 	const wiring = getActiveWorkloadAwsWiring();
 	if (wiring) {
-		const { attachLoopbackForwarder } = await import("./docker-runner-D9E9mLH-.js").then((n) => n.o);
+		const { attachLoopbackForwarder } = await import("./docker-runner-CLlVjU7l.js").then((n) => n.o);
 		await attachLoopbackForwarder(containerId, wiring);
 	}
 };
@@ -16392,7 +16474,7 @@ async function detachFromSharedNetwork(target, networkName) {
 	const logger = getLogger().child("ecs-service");
 	let ip;
 	try {
-		ip = await getContainerNetworkIp(target.id, networkName);
+		ip = await getContainerNetworkIp(target.endpoint, networkName);
 	} catch {
 		ip = void 0;
 	}
@@ -16402,17 +16484,22 @@ async function detachFromSharedNetwork(target, networkName) {
 	}
 	let publishesHostPorts;
 	try {
-		publishesHostPorts = await dockerInspectPublishesHostPortsImpl(target.id);
+		publishesHostPorts = await dockerInspectPublishesHostPortsImpl(target.endpoint);
 	} catch {
 		publishesHostPorts = true;
 	}
+	if (target.joined && publishesHostPorts) {
+		logger.debug(`Soft-reload: ${displayIdent(target.name)} (${target.id}) publishes host ports through its loopback forwarder; restarting it in place without detaching its network aliases first.`);
+		return;
+	}
 	try {
-		await dockerNetworkDisconnectImpl(networkName, target.id);
+		await dockerNetworkDisconnectImpl(networkName, target.endpoint);
 	} catch (err) {
 		logger.debug(`Soft-reload: detaching ${displayIdent(target.name)} (${target.id}) from ${networkName} failed: ${err instanceof Error ? err.message : String(err)}. Restarting it in place.`);
 		return;
 	}
 	return {
+		endpointId: target.endpoint,
 		networkName,
 		ip,
 		aliases: target.aliases,
@@ -16425,16 +16512,19 @@ const DEFAULT_RELOAD_DRAIN_MS = 1e3;
 let reloadDrainMs = DEFAULT_RELOAD_DRAIN_MS;
 async function reattachForDrain(plans) {
 	let any = false;
-	for (const [id, plan] of plans) try {
-		await attachToSharedNetwork(id, plan, false);
-		any = true;
-	} catch (err) {
-		getLogger().child("ecs-service").debug(`Soft-reload: drain re-attach of ${id} to ${plan.networkName} failed: ${err instanceof Error ? err.message : String(err)}. Stopping it without a drain.`);
+	for (const plan of plans.values()) {
+		const id = plan.endpointId;
+		try {
+			await attachToSharedNetwork(plan, false);
+			any = true;
+		} catch (err) {
+			getLogger().child("ecs-service").debug(`Soft-reload: drain re-attach of ${id} to ${plan.networkName} failed: ${err instanceof Error ? err.message : String(err)}. Stopping it without a drain.`);
+		}
 	}
 	return any;
 }
-async function attachToSharedNetwork(containerId, plan, withAliases) {
-	await dockerNetworkConnectImpl(plan.networkName, containerId, {
+async function attachToSharedNetwork(plan, withAliases) {
+	await dockerNetworkConnectImpl(plan.networkName, plan.endpointId, {
 		ip: plan.ip,
 		aliases: withAliases ? plan.aliases : []
 	});
@@ -16471,12 +16561,12 @@ async function disconnectOldFromSharedNetwork(oldInstance, opts = {}) {
 	const network = oldInstance.state.network;
 	if (!network || !network.ownedByCaller) return;
 	const networkName = network.networkName;
+	const targets = [...new Set(oldInstance.state.startedContainers.map((c) => networkEndpointId(oldInstance.state, c.name, c.id)))];
 	const drainIps = /* @__PURE__ */ new Map();
-	if (opts.drain) for (const c of oldInstance.state.startedContainers) {
-		const ip = await getContainerNetworkIp(c.id, networkName).catch(() => void 0);
-		if (ip) drainIps.set(c.id, ip);
+	if (opts.drain) for (const id of targets) {
+		const ip = await getContainerNetworkIp(id, networkName).catch(() => void 0);
+		if (ip) drainIps.set(id, ip);
 	}
-	const targets = oldInstance.state.startedContainers.map((c) => c.id);
 	for (const id of targets) try {
 		await dockerNetworkDisconnectImpl(networkName, id);
 	} catch (err) {}
@@ -16541,7 +16631,7 @@ async function waitForReplicaTcpReady(service, replica, opts) {
 		} else {
 			if (ip === void 0) {
 				try {
-					ip = await getContainerNetworkIp(started.id, networkName);
+					ip = await getContainerNetworkIp(networkEndpointId(replica.state, started.name, started.id), networkName);
 				} catch (err) {
 					logger.warn(`${label}: TCP-ready probe could not resolve docker IP: ${err instanceof Error ? err.message : String(err)}. Proceeding.`);
 					return "not-ready";
@@ -20110,6 +20200,12 @@ async function localRunTaskCommand(target, options, extraStateProviders) {
 		if (options.detach) {
 			logger.info(`Task containers started in detached mode; ${getEmbedConfig().binaryName} is exiting.`);
 			logger.info(`Use 'docker ps --filter network=${result.state.network?.networkName ?? "<network>"}' to inspect; tear down with 'docker rm -f' and 'docker network rm'.`);
+			const joinedForwarders = result.state.forwarders.filter((f) => f.joined);
+			if (joinedForwarders.length > 0) {
+				const joinedNames = new Set(joinedForwarders.map((f) => f.containerName));
+				const containers = result.state.startedContainers.filter((c) => joinedNames.has(c.name)).map((c) => c.id.slice(0, 12)).join(", ");
+				logger.info(`Under the loopback AWS endpoint, task containers share the network of a forwarder container, so that filter does not list them. Task container ids: ${containers}. Remove them before the forwarders (${joinedForwarders.map((f) => f.name).join(", ")}).`);
+			}
 			sigintCount = 99;
 			return;
 		}
@@ -31651,4 +31747,4 @@ function addStudioSpecificOptions(cmd) {
 
 //#endregion
 export { postHook as $, addAwsEndpointOptions as $a, parseConnectionsPath as $i, addImageOverrideOptions as $n, addStartApiSpecificOptions as $r, classifyS3Error as $t, microvmFidelityWarnings as A, parseSelectionExpressionPath as Aa, applyCorsResponseHeaders as Ai, stripCloudFrontImport as An, A2A_CONTAINER_PORT as Ar, readContainerLogTail as At, MICROVM_WS_BASE_PROTOCOL as B, AgentCoreResolutionError as Ba, evaluateResponseParameters as Bi, createLocalStartAlbCommand as Bn, AGENTCORE_SESSION_ID_HEADER as Br, parseWebFunctionBuildConfig as Bt, addListSpecificOptions as C, resolveSingleTarget as Ca, verifyJwtViaDiscovery as Ci, WEB_FUNCTION_REVISION_TYPE as Cn, setShadowReadyTimeoutMs as Cr, parseKvsFileOverrides as Ct, buildMicrovmLambdaView as D, discoverWebSocketApis as Da, invokeRequestAuthorizer as Di, compileCloudFrontFunction as Dn, createLocalInvokeAgentCoreCommand as Dr, WEB_FUNCTION_CONTAINER_PORT as Dt, addStartMicrovmSpecificOptions as E, availableWebSocketApiIdentifiers as Ea, evaluateCachedLambdaPolicy as Ei, resolveWebFunctionTarget as En, addInvokeAgentCoreSpecificOptions as Er, RecentOutput as Et, microvmImageTag as F, AGENTCORE_A2A_PROTOCOL as Fa, matchRoute as Fi, findFileAssetForObjectKey as Fn, MCP_PROTOCOL_VERSION as Fr, buildNodeEntryFileStart as Ft, startMicrovmFrontDoor as G, containsDynamicReference as Ga, HOST_DOCKER_INTERNAL_GATEWAY as Gi, addStartServiceSpecificOptions as Gn, SUPPORTED_CODE_RUNTIMES as Gr, readWebFunctionServiceConfig as Gt, PROXY_PORT_HEADER as H, resolveAgentCoreTarget as Ha, selectIntegrationResponse as Hi, resolveAlbTarget as Hn, waitForAgentCoreHttpReady as Hr, WEB_FUNCTION_HTTP_ENDPOINT_ENV as Ht, planMicrovmPorts as I, AGENTCORE_AGUI_PROTOCOL as Ia, translateLambdaResponse as Ii, isBucketDeploymentResource as In, mcpInvokeOnce as Ir, defaultWebFunctionPlatform as It, MICROVM_HOOK_PATH_PREFIX as J, keysNotFromTemplate as Ja, resolveHostGatewayExtraHosts as Ji, addRunTaskSpecificOptions as Jn, renderCodeDockerfile as Jr, idFromArn as Jt, stripMicrovmProxyHeaders as K, deployedFillMayBeSecret as Ka, HOST_GATEWAY_MIN_VERSION as Ki, createLocalStartServiceCommand as Kn, buildAgentCoreCodeImage as Kr, webFunctionAssumeRole as Kt, readExposedPorts as L, AGENTCORE_HTTP_PROTOCOL as La, applyAuthorizerOverlay as Li, resolveBucketDeploymentObjectKey as Ln, parseSseForJsonRpc as Lr, resolveWebFunctionRuntime as Lt, DEFAULT_TERMINATE_HOOK_TIMEOUT_MS as M, discoverRoutes as Ma, buildCorsConfigFromCloudFrontChain as Mi, createLocalFileKvsDataSource as Mn, a2aInvokeOnce as Mr, waitForWebFunctionReady as Mt, LocalMicrovm as N, pickRefLogicalId as Na, isFunctionUrlOacFronted as Ni, createUnboundCloudFrontModule as Nn, MCP_CONTAINER_PORT as Nr, watchContainerExit as Nt, createLocalStartMicrovmCommand as O, discoverWebSocketApisOrThrow as Oa, invokeTokenAuthorizer as Oi, runViewerRequest as On, bridgeAgentCoreWs as Or, containerFailure as Ot, buildMicrovmImage as P, resolveLambdaArnIntrinsic as Pa, matchPreflight as Pi, bucketDeploymentSourceObjectKeys as Pn, MCP_PATH as Pr, WEB_FUNCTION_RUNTIMES as Pt, pollBuildHook as Q, withoutKeys as Qa, handleConnectionsRequest as Qi, addEcsAssumeRoleOptions as Qn, createLocalInvokeCommand as Qr, resolveDeployedOriginBucket as Qt, setContainerPaused as R, AGENTCORE_MCP_PROTOCOL as Ra, buildHttpApiV2Event as Ri, addAlbSpecificOptions as Rn, AGENTCORE_SIGV4_SERVICE as Rr, supportedWebFunctionRuntimes as Rt, StudioEventBus as S, resolveWatchConfig as Sa, verifyJwtAuthorizer as Si, WEB_FUNCTION_ENDPOINT_TYPE as Sn, SOFT_RELOAD_COMPLETION_LOG_SUFFIX as Sr, normalizeKvsFileKeys as St, formatTargetListing as T, listTargets as Ta, computeRequestIdentityHash as Ti, WebFunctionResolutionError as Tn, attachContainerLogStreamer as Tr, resolveCloudFrontTarget as Tt, rewriteUpgradeResponseHead as U, DynamicReferenceResolutionError as Ua, tryParseStatus as Ui, isApplicationLoadBalancer as Un, waitForAgentCorePing as Ur, buildWebFunctionLambdaView as Ut, MicrovmStateError as V, pickAgentCoreCandidateStack as Va, pickResponseTemplate as Vi, parseLbPortOverrides as Vn, invokeAgentCore as Vr, resolveWebFunctionArtifact as Vt, selectTargetPort as W, DynamicReferenceResolver as Wa, VtlEvaluationError as Wi, resolveAlbFrontDoor as Wn, downloadAndExtractS3Bundle as Wr, finalizeWebFunctionEnv as Wt, callRuntimeHook as X, parseDynamicReference as Xa, ConnectionRegistry as Xi, MAX_TASKS_SUBNET_RANGE_CAP as Xn, classifySourceChange as Xr, createDeployedKvsDataSource as Xt, MicrovmHookError as Y, keysOverriddenBy as Ya, bufferToBody as Yi, createLocalRunTaskCommand as Yn, toCmdArgv as Yr, resolveKvsModulesForDistribution as Yt, generateMicrovmId as Z, resolveDynamicReferencesInEnv as Za, buildMgmtEndpointEnvUrl as Zi, addCommonEcsServiceOptions as Zn, addInvokeSpecificOptions as Zr, resolveDeployedKvsArnByName as Zt, filterStudioTargetGroups as _, resolveCfnRegion as _a, defaultCredentialsLoader as _i, pickKvsLogicalIdFromArn as _n, isLocalCdkAssetImage as _r, attachAgentCoreWsBridge as _t, createLocalStudioCommand as a, resolveRuntimeImage as aa, attachStageContext as ai, serveLambdaUrlOrigin as an, resolveSharedSidecarCredentials as ar, disposeMicrovmCodeArtifact as at, renderStudioHtml as b, collectSsmParameterRefs as ba, createJwksCache as bi, pickWebFunctionEndpointLogicalIdFromOrigin as bn, CloudMapRegistry as br, addStartCloudFrontSpecificOptions as bt, startStudioProxy as c, substituteAgainstState as ca, resolveEnvVars$1 as ci, buildEdgeRequestEvent as cn, buildImageOverrideTag as cr, resolveMicrovmImageTarget as ct, createStudioDispatcher as d, substituteEnvVarsFromStateAsync as da, filterRoutesByApiIdentifiers as di, httpHeadersToEdge as dn, mergeForService as dr, createLocalStartWebFunctionCommand as dt, buildConnectEvent as ea, createLocalStartApiCommand as ei, createS3OriginReader as en, awsEndpointOptions as eo, buildEcsImageResolutionContext$1 as er, runHookBody as et, filterStudioCustomResources as f, LocalStateSourceError as fa, groupRoutesByServer as fi, CLOUDFRONT_DISTRIBUTION_TYPE as fn, parseImageOverrideFlags as fr, addStartAgentCoreSpecificOptions as ft, annotatePinnedEcsTargets as g, resolveCfnFallbackRegion as ga, resolveServiceIntegrationParameters as gi, pickFunctionUrlLogicalIdFromOrigin as gn, imageOverrideKeyAliases as gr, startAgentCoreHttpServer as gt, annotateEcsTaskPinnedTargets as h, rejectExplicitCfnStackWithMultipleStacks as ha, resolveSelectionExpression as hi, isCloudFrontDistribution as hn, describePinnedImageUri as hr, selectServeInboundAuth as ht, coerceStopRequest as i, resolveRuntimeFileExtension as ia, createFileWatcher as ii, serveFromStaticOrigin as in, resolveEcsAssumeRoleOption as ir, MicrovmResolutionError as it, readRunHookPayload as j, webSocketApiMatchesIdentifier as ja, buildCorsConfigByApiId as ji, createCloudFrontModule as jn, A2A_PATH as jr, startWebFunctionContainer as jt, finalizeMicrovmEnv as k, filterWebSocketApisByIdentifiers as ka, attachAuthorizers as ki, runViewerResponse as kn, invokeAgentCoreWs as kr, planWebFunctionContainer as kt, relayServeRequest as l, substituteAgainstStateAsync as la, availableApiIdentifiers as li, buildEdgeResponseEvent as ln, canonicalizeImageOverrideKeys as lr, s3KeyOfUri as lt, annotateAlbPinnedBackingServices as m, isCfnFlagPresent as ma, startApiServer as mi, extractKvsAssociations as mn, runImageOverrideBuilds as mr, buildAgentCoreServeAuthCheck as mt, coerceRunRequest as n, buildMessageEvent as na, resolveApiTargetSubset as ni, startCloudFrontServer as nn, parseMaxTasks as nr, MICROVM_DEFAULT_INGRESS_PORT as nt, resolveServeBaseUrl as o, EcsTaskResolutionError as oa, buildStageMap as oi, applyEdgeRequestResult as on, runEcsServiceEmulator as or, readMicrovmImageConfig as ot, isCustomResourceLambdaTarget as p, createLocalStateProvider as pa, readMtlsMaterialsFromDisk as pi, describeS3OriginDomain as pn, resolveImageOverrides as pr, createLocalStartAgentCoreCommand as pt, MAX_RUN_HOOK_PAYLOAD_BYTES as q, firstUsableRegion as qa, probeHostGatewaySupport as qi, serviceStrategy as qn, computeCodeImageTag as qr, webFunctionFidelityWarnings as qt, coerceServeRequest as r, resolveRuntimeCodeMountPath as ra, createAuthorizerCache as ri, resolveErrorResponseCandidates as rn, parseRestartPolicy as rr, MICROVM_IMAGE_TYPE as rt, createStudioServeManager as s, assertEcsTaskImagesResolvable as sa, materializeLayerFromArn as si, applyEdgeResponseResult as sn, ImageOverrideError as sr, resolveMicrovmCodeArtifact as st, addStudioSpecificOptions as t, buildDisconnectEvent as ta, createWatchPredicates as ti, matchBehavior as tn, ecsClusterOption as tr, waitForAppAnswer as tt, reinvoke as u, substituteEnvVarsFromState as ua, filterRoutesByApiIdentifier as ui, edgeHeadersToHttp as un, enforceImageOverrideOrphans as ur, addStartWebFunctionSpecificOptions as ut, startStudioServer as v, resolveCfnStackName as va, buildCognitoJwksUrl as vi, pickLambdaEdgeFunctionLogicalId as vn, listPinnedTargets as vr, startAgentCoreWsBridge as vt, createLocalListCommand as w, countTargets as wa, buildMethodArn as wi, WEB_FUNCTION_TYPE as wn, getContainerNetworkIp as wr, parseOriginOverrides as wt, createStudioStore as x, resolveSsmParameters as xa, verifyCognitoJwt as xi, resolveCloudFrontDistribution as xn, DEFAULT_SHADOW_READY_TIMEOUT_MS as xr, createLocalStartCloudFrontCommand as xt, toStudioTargetGroups as y, CfnLocalStateProvider as ya, buildJwksUrlFromIssuer as yi, pickTargetFunctionLogicalId as yn, buildCloudMapIndex as yr, LocalStartCloudFrontError as yt, MICROVM_CONTROL_PATH as z, AGENTCORE_RUNTIME_TYPE as za, buildRestV1Event as zi, albStrategy as zn, signAgentCoreInvocation as zr, disposeWebFunctionArtifact as zt };
-//# sourceMappingURL=local-studio-CVy7mUW9.js.map
+//# sourceMappingURL=local-studio-D8eIrFzx.js.map